-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
FEATURE: add an env-sharing script #29
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice work! Thanks! 🚀
Is it possible to add an option such as the script reads the users from a file?
That would be handy to avoid putting all the names of the team each time.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I personally have nothing to say about the code in itself but after trying it I have 4 points:
- as @atxr said it please provide a dependency check for
gpg
and the archive software - the script currently doesn't work well for user in two word, I tried with mine "Clement Mabileau" --> it interprets it as two different users and then creates two encrypted file. But that's normal looking at the code and I don't think that's important once you know it, you just have to specify only
./gpg-share.sh file Mabileau
! - currently the script isn't really clean because it leaves the user with multiple encrypted files at root without removing them after the archive is created (or
7zz
does it? I could find out because I don't have this one 😕), consider either cleaning them or put them in/tmp
I think! - you should add the
script
folder to the README repository structure I think!
For instance, as `npm` is not installed on my machine but required to get the version of the project, i have ```bash > ./scripts/gpg-share.sh .env.example "Alexandre Tullot" ./scripts/gpg-share.sh: warning: 'npm' is required ./scripts/gpg-share.sh: error: one or more dependencies are missing ```
This commit does 3 things: - move the user check after the creation of the `users` array, to avoid passing `users` to the function and breaking the array (bash...) - read `stdin` when `USER_FILE` is not defined and use `readarray` when it is set and the file exists - remove the extra newline from the user name with `echo -n "$_user"` (bash... it works in a shell but not in the script :shrugging:)
the dependencies might change, e.g.
yep, that's how arrays work in # users.txt
Alexandre Tullot
amtoine and USER_FILE=users.txt ./scripts/gpg-share .env.production should only try to use "
i moved the files to
added in 7c68495 😋 |
i've tried that in the previous comment and commits 😉 |
love these three tks! However the script still doesn't work as expected, but that seems normal as you couldn't test it 😕
So why does it says weird things about the the key not belonging to the named user?
Or is it because of the weird Also when using the
and
Every of these bugs would have been found by you if you could run it on your computer 😕 , maybe you can create a VM or a container? or test it through ssh on the iscsc server? |
i can test the script by applying diff --git a/scripts/gpg-share.sh b/scripts/gpg-share.sh
index 3619dfd..300a4e4 100755
--- a/scripts/gpg-share.sh
+++ b/scripts/gpg-share.sh
@@ -26,7 +26,7 @@ log_info () {
DEPENDENCIES=(
- npm
+ # npm
gpg
7zz
)
@@ -52,7 +52,8 @@ check_dependencies () {
check_dependencies
# get the version
-VERSION=$(npm pkg get version | sed 's/"//g')
+# VERSION=$(npm pkg get version | sed 's/"//g')
+VERSION="0.1.0"
# build the archive name
ARCHIVE="keys-${VERSION}.7z" do not worry 😉
|
if forgot a fix regarding the fix should be complete in 30f860c |
so, for now, please test the script only from the root 😉 |
|
yep, this script assumes the keyring of the user is in good shape 🤔 the path
i've added a check in b069dd5 the USER_FILE variable
cool 💪
i've changed the way i store the files in the archive:grey_exclamation:
that way
i can think of that after the above changes are good to go 😉 |
mm, for the multi-word users.... what about not allowing them? EDITactually it's an issue with the way propositionthe following diff diff --git a/scripts/gpg-share.sh b/scripts/gpg-share.sh
index dbb4041..0482eed 100755
--- a/scripts/gpg-share.sh
+++ b/scripts/gpg-share.sh
@@ -137,7 +138,7 @@ encrypt () {
do
user=$(echo -n "$_user")
log_info "encrypting '$file' for '$user' inside '$DUMP_DIR'..."
- gpg --verbose --recipient "$user" --encrypt --armor --output "$DUMP_DIR/$file.$user.asc" "$file"
+ gpg --verbose --recipient "$user" --encrypt --armor --output $(echo "$DUMP_DIR/$file.$user.asc" | sed 's/\s\+/-/g') "$file"
done
log_success "all encrypted file have been saved inside '$DUMP_DIR'"
}
@@ -149,7 +150,7 @@ archive () {
# subshell here to avoid archiving the paths to the .asc files
(
cd "$DUMP_DIR"
- tar cvf "$ARCHIVE" $(find . -type f)
+ tar cvf "$ARCHIVE" $(find . -type f | sed 's/\s\+/-/g')
)
cp "$DUMP_DIR/$ARCHIVE" .
} works with amtoine
Alexandre tullot i simply replace the whitespaces in the filenames with "-" 😏 |
the path when running
Exactly what I thought about! Tks a lot! multiple works user ids/ whitespaces problem
I really love that! It's really prettier I think and also more reliable 😉
I was just going to ping you about that... However you don't need this - tar cvf "$ARCHIVE" $(find . -type f)
+ tar cvf "$ARCHIVE" $(find . -type f | sed 's/\s\+/-/g') because you already saved the encrypted files without whitspaces 😉, but it sure doesn't harm 👍 Overall I agree with your proposition flags
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You did an amazing work thank you for your contribution!
As @ctmbl said, it works fine for me with names of multiple words with this diff
- gpg --verbose --recipient "$user" --encrypt --armor --output "$DUMP_DIR/$file.$user.asc" "$file"
+ gpg --verbose --recipient "$user" --encrypt --armor --output $(echo "$DUMP_DIR/$file.$user.asc" | sed 's/\s\+/-/g') "$file"
Regarding the user option with -u
and -U
it would be great but that's up to you. This script solves the initial issue, so I'll approve this merge! 🚀
glad it works 😌 i've added the fix in the latest a04938a 👍 flags -u and -U
if that's ok with you both, i'd like to close this PR, as @atxr said it solves the original issue, and think of improvements in an issue i can open right after the merge 😋 |
also, please solve the threads if they have been addressed 😉 |
Perfect 👌 flags -u and -U
Totally fine for me 😉 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@ctmbl, there it is 👌 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great! Ready to merge this one 🚀
Related to #13.
This PR adds a script, in the
./scripts/
directory, to easily share secret files to the members of theiscsc.fr
team.the script itself
usage
./scripts/gpg-share.sh $file $[list of gpg users]
source
legend
🔵 there is an info
🟢 there is a success message
🟠 there is a warning
🔴 there is an error and the script halts
in order
$file
and checks:gpg
🔵$ARCHIVE
with7z
🔵